TL;DR: Identity security programmes must meet organisations at different maturity levels, with examples showing faster joiner, mover, leaver processing, shorter certification cycles, and broader access visibility across large enterprises, according to SailPoint. The operational lesson is that lifecycle automation and access governance remain the real determinants of control at scale.
At a glance
What this is: This is a SailPoint blog arguing that identity security programmes stall when lifecycle automation, certifications and access visibility do not keep pace with enterprise scale.
Why it matters: It matters because IAM, IGA and PAM teams cannot rely on point controls alone when joiner, mover and leaver work still depends on manual processing and fragmented ownership.
Context
Identity security programmes fail when lifecycle work is still handled manually. Joiner, mover and leaver events, access certifications and application onboarding all depend on timely orchestration, and that orchestration becomes harder as organisations add applications, operating companies and request paths.
In SailPoint's examples, the challenge is not whether access should be governed, but how fast and consistently it can be governed across different business models. That makes lifecycle automation the practical test of whether an identity programme is really scalable, not just well designed.
Key questions
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations. Access changes arrive late, offboarding becomes dependent on ticket discipline, and audit evidence is fragmented. The result is entitlement creep and a larger attack surface because the organisation cannot prove that access changed when the business event changed.
Q: Why do certification campaigns slow down in large organisations?
A: Certification campaigns slow down when the workflow asks too much of individual reviewers and the interface makes decisions hard to complete quickly. Reviewers delay when they cannot easily understand status, action, or ownership. That creates a control risk because access remains in place while the campaign waits.
Q: How do organisations know whether identity lifecycle automation is actually working?
A: They should measure execution coverage, revocation delay, and audit completeness across the full app estate, not just in the IdP. If a meaningful set of applications still requires tickets, spreadsheets, or manual exports, lifecycle automation is partial. A healthy programme can prove that access changes reach the systems where they matter, and that evidence is available without reconstruction.
Q: How should organisations govern access beyond lifecycle automation?
A: They should separate workflow execution from governance proof. Lifecycle automation can provision or revoke access, but governance must certify that access is still appropriate, enforce separation of duties, and preserve audit evidence. The practical test is whether the organisation can prove who approved access, what changed, and whether the change actually took effect.
Technical breakdown
Lifecycle automation as an identity control plane
Lifecycle automation is the machinery that turns identity governance from a periodic administrative task into a repeatable control plane. It links HR events, role changes, application entitlements and approval workflows so joiner, mover and leaver actions happen consistently across systems. Without that orchestration, certification and request management become downstream clean-up rather than preventive controls. The article's examples show that the value is not only speed, but the ability to keep policy, provisioning and review aligned as the business grows.
Practical implication: treat lifecycle orchestration as core control infrastructure, not as a convenience layer.
Why certification cycles slow down when access data is fragmented
Access certification depends on having a current, trustworthy inventory of who has access to what and why. When access is spread across multiple platforms or managed in separate request centres, reviewers have to reconcile incomplete records and approvals take longer. That is why a 'single source of truth' matters operationally, not just conceptually. The Nordnet example shows the difference between a certification process that is administratively possible and one that is actually reviewable at enterprise pace.
Practical implication: consolidate entitlement visibility before trying to shorten review windows.
Joiner, mover and leaver automation reduces governance lag
Joiner, mover and leaver processing is where identity programmes either keep up with business change or fall behind it. Manual onboarding, role updates and termination steps create delay, error and privilege drift, especially when HR and core technology platforms are updated independently. Automation matters because it shortens the window in which access exists without current business justification. In this article, the operational gains come from connecting JML events directly to identity workflows across platforms and directory services.
Practical implication: wire HR and access systems together so lifecycle events drive entitlement changes immediately.
NHI Mgmt Group analysis
Lifecycle automation is the real maturity boundary in identity security. An identity programme can look complete on paper while still depending on manual joiner, mover and leaver handling behind the scenes. That is where delays, errors and access drift accumulate, especially as organisations add more applications and operating units. The practitioner conclusion is simple: maturity is measured by whether lifecycle events execute consistently without human rework.
Single-source access visibility has become a governance prerequisite, not a reporting feature. Access certification only works when reviewers can trust the entitlement record they are reviewing. When request, approval and review data live in separate systems, the control becomes slower and weaker even if the policy is sound. The implication is that review quality now depends on the integrity of the access inventory itself.
Joiner, mover and leaver automation is where identity security proves its business value. The article's examples show that organisations care about onboarding efficiency, remote work enablement and application rationalisation, but those outcomes all depend on lifecycle execution. In other words, lifecycle automation is how identity programmes convert governance intent into repeatable operational control. The practitioner conclusion is to judge identity platforms by how much manual lifecycle work they remove.
Identity security journeys are not linear, so control design cannot be linear either. Different businesses start with different priorities, such as onboarding speed, remote access control or certification maturity, but all of them eventually hit the same scaling constraint: manual governance does not compound well. That creates a planning problem for IAM, IGA and PAM teams because the next control investment should follow the weakest lifecycle segment, not the loudest feature request. The practitioner conclusion is to sequence improvement around the control gap that most limits scale.
Lifecycle automation exposes the programme's operating model, not just its tooling. A common mistake is to treat identity as a product deployment problem when the real issue is how HR, application owners and access governance share responsibility. The article shows that successful deployments depend on implementation partners, internal experts and executive alignment as much as on platform capability. The practitioner conclusion is to design the operating model around lifecycle ownership before expecting automation to hold.
What this signals
Lifecycle bottlenecks are now the clearest signal that an identity programme has outgrown manual governance. When joiner, mover and leaver handling still relies on human follow-up, the control environment cannot scale at the same pace as the business. That is why lifecycle automation should be read as an operating-model requirement, not a deployment preference.
Access review quality depends on the quality of the entitlement record. Certification cycles do not improve just because the review window is shorter. They improve when reviewers can trust the underlying access inventory, which is why lifecycle governance and visibility need to be designed together.
For practitioners
- Map manual lifecycle handoffs Identify where joiner, mover and leaver events still depend on ticketing, spreadsheets or ad hoc approvals, then rank those steps by delay and error rate.
- Build a current access inventory Unify request, certification and entitlement data so reviewers are working from one authoritative view of access instead of reconciling multiple records.
- Automate JML triggers from HR Connect HR status changes and role updates directly to provisioning and deprovisioning workflows across core applications and directory services.
- Shorten certification backlog time Measure how long review campaigns take today, then remove entitlement ambiguity and owner lookup delays before changing the review cadence.
Key takeaways
- Identity security journeys break down where lifecycle events still require manual handling across multiple systems.
- The article's examples show that automation can reduce joiner, mover and leaver friction and shorten certification cycles.
- For practitioners, the practical priority is to improve access visibility and lifecycle orchestration before expecting better governance outcomes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Leaver handling is a central lifecycle risk in the article's JML discussion. |
| NHI-05 — Overprivileged NHI | Lifecycle drift can leave identities with access beyond current business need. | |
| Recommendation — Automate offboarding triggers so access removal follows termination events without manual delay. Review lifecycle-linked entitlements for excess privilege and remove access that no longer matches role. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on governing who has what access and keeping the record current. |
| Recommendation — Maintain authoritative entitlement records so approvals and certifications use current access state. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article is fundamentally about account lifecycle handling across joiner, mover and leaver events. |
| Recommendation — Centralise account lifecycle management and remove manual exceptions from onboarding and termination. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Account provisioning, changes and termination are the core operational controls discussed. |
| Recommendation — Apply account management controls to automate provisioning, modification and deprovisioning workflows. | ||
Key terms
- Lifecycle Automation: The automation of identity events such as onboarding, access changes, and revocation so governance follows the full user or account lifecycle. It reduces manual errors, shortens exposure windows, and helps organisations enforce consistent access controls at scale.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
- Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
- Single source of truth: A single source of truth is the authoritative system that holds the current state of identity and access records. In practice, it reduces reconciliation work, improves auditability, and gives security teams one place to enforce policy and detect drift.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org